CVE-2022-49016
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/10/2024
Last modified:
24/10/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net: mdiobus: fix unbalanced node reference count<br />
<br />
I got the following report while doing device(mscc-miim) load test<br />
with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled:<br />
<br />
OF: ERROR: memory leak, expected refcount 1 instead of 2,<br />
of_node_get()/of_node_put() unbalanced - destroy cset entry:<br />
attach overlay node /spi/soc@0/mdio@7107009c/ethernet-phy@0<br />
<br />
If the &#39;fwnode&#39; is not an acpi node, the refcount is get in<br />
fwnode_mdiobus_phy_device_register(), but it has never been<br />
put when the device is freed in the normal path. So call<br />
fwnode_handle_put() in phy_device_release() to avoid leak.<br />
<br />
If it&#39;s an acpi node, it has never been get, but it&#39;s put<br />
in the error path, so call fwnode_handle_get() before<br />
phy_device_register() to keep get/put operation balanced.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.14 (including) | 5.15.82 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.0.12 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



